temporary commit

evgeniy-scherbina · evgeniy-scherbina · commit 13d7e1efe928 · 2025-07-07T20:46:18.000Z
diff --git a/coderd/database/dbauthz/dbauthz.go b/coderd/database/dbauthz/dbauthz.go
@@ -3872,13 +3872,12 @@ func (q *querier) InsertUserLink(ctx context.Context, arg database.InsertUserLin
 }
 
 func (q *querier) InsertUserSecret(ctx context.Context, arg database.InsertUserSecretParams) (database.UserSecret, error) {
-	return database.UserSecret{}, nil
-
-	//if err := q.authorizeContext(ctx, policy.ActionUpdate, rbac.ResourceUserObject(arg.UserID)); err != nil {
-	//	return database.UserLink{}, err
-	//}
+	obj := rbac.ResourceUserSecret.WithOwner(arg.UserID.String())
+	if err := q.authorizeContext(ctx, policy.ActionCreate, obj); err != nil {
+		return database.UserSecret{}, err
+	}
 
-	//return q.db.InsertUserLink(ctx, arg)
+	return q.db.InsertUserSecret(ctx, arg)
 }
 
 func (q *querier) InsertVolumeResourceMonitor(ctx context.Context, arg database.InsertVolumeResourceMonitorParams) (database.WorkspaceAgentVolumeResourceMonitor, error) {
diff --git a/coderd/database/dbauthz/dbauthz_test.go b/coderd/database/dbauthz/dbauthz_test.go
@@ -5718,3 +5718,13 @@ func (s *MethodTestSuite) TestAuthorizePrebuiltWorkspace() {
 			}).Asserts(w, policy.ActionUpdate, w.AsPrebuild(), policy.ActionUpdate)
 	}))
 }
+
+func (s *MethodTestSuite) TestUserSecrets() {
+	s.Run("InsertUserSecret", s.Subtest(func(db database.Store, check *expects) {
+		user := dbgen.User(s.T(), db, database.User{})
+		arg := database.InsertUserSecretParams{
+			UserID: user.ID,
+		}
+		check.Args(arg).Asserts(rbac.ResourceUserSecret.WithOwner(arg.UserID.String()), policy.ActionCreate)
+	}))
+}
diff --git a/coderd/database/dbgen/dbgen.go b/coderd/database/dbgen/dbgen.go
@@ -1352,6 +1352,19 @@ func PresetParameter(t testing.TB, db database.Store, seed database.InsertPreset
 	return parameters
 }
 
+func UserSecret(t testing.TB, db database.Store, seed database.InsertUserSecretParams) database.UserSecret {
+	schedule, err := db.InsertUserSecret(genCtx, database.InsertUserSecretParams{
+		ID:          takeFirst(seed.ID, uuid.New()),
+		UserID:      takeFirst(seed.UserID, uuid.New()),
+		Name:        takeFirst(seed.Name, "secret-name"),
+		Description: takeFirst(seed.Description, "secret description"),
+		Value:       takeFirst(seed.Value, "secret value"),
+		ValueKeyID:  takeFirst(seed.ValueKeyID, sql.NullString{}),
+	})
+	require.NoError(t, err, "insert preset prebuild schedule")
+	return schedule
+}
+
 func provisionerJobTiming(t testing.TB, db database.Store, seed database.ProvisionerJobTiming) database.ProvisionerJobTiming {
 	timing, err := db.InsertProvisionerJobTimings(genCtx, database.InsertProvisionerJobTimingsParams{
 		JobID:     takeFirst(seed.JobID, uuid.New()),
diff --git a/coderd/database/dump.sql b/coderd/database/dump.sql
diff --git a/coderd/database/migrations/000349_add_user_secrets.down.sql b/coderd/database/migrations/000349_add_user_secrets.down.sql
@@ -1 +1,2 @@
 DROP TABLE user_secrets;
+-- TODO: DROP index
diff --git a/coderd/database/migrations/000349_add_user_secrets.up.sql b/coderd/database/migrations/000349_add_user_secrets.up.sql
@@ -3,7 +3,7 @@ CREATE TABLE user_secrets (
     id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
     user_id UUID NOT NULL REFERENCES users(id) ON DELETE CASCADE,
     name TEXT NOT NULL,
-    description TEXT,
+    description TEXT NOT NULL,
 
     -- The encrypted secret value (base64-encoded encrypted data)
     value TEXT NOT NULL,
diff --git a/coderd/database/modelmethods.go b/coderd/database/modelmethods.go
@@ -617,8 +617,5 @@ func (m WorkspaceAgentVolumeResourceMonitor) Debounce(
 }
 
 func (s UserSecret) RBACObject() rbac.Object {
-	return rbac.ResourceUserSecret.WithID(s.ID).
-		InOrg(s.OrganizationID).
-		WithACLUserList(t.UserACL).
-		WithGroupACL(t.GroupACL)
+	return rbac.ResourceUserSecret.WithOwner(s.UserID.String())
 }
diff --git a/coderd/database/models.go b/coderd/database/models.go
diff --git a/coderd/database/queries.sql.go b/coderd/database/queries.sql.go

Original file line number	Diff line number	Diff line change
`@@ -1 +1,2 @@`
`1`	`1`	`DROP TABLE user_secrets;`
	`2`	`+-- TODO: DROP index`
Original file line number	Diff line number	Diff line change
`@@ -617,8 +617,5 @@ func (m WorkspaceAgentVolumeResourceMonitor) Debounce(`
`617`	`617`	`}`
`618`	`618`
`619`	`619`	`func (s UserSecret) RBACObject() rbac.Object {`
`620`		`- return rbac.ResourceUserSecret.WithID(s.ID).`
`621`		`- InOrg(s.OrganizationID).`
`622`		`- WithACLUserList(t.UserACL).`
`623`		`- WithGroupACL(t.GroupACL)`
	`620`	`+ return rbac.ResourceUserSecret.WithOwner(s.UserID.String())`
`624`	`621`	`}`